upload-safety 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Simon Halimonov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,185 @@
-# Temporary Holding Version
+# upload-safety
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![npm](https://img.shields.io/npm/v/upload-safety?color=cb3837)](https://www.npmjs.com/package/upload-safety)
+[![CI](https://github.com/simulieren/upload-safety/actions/workflows/ci.yml/badge.svg)](https://github.com/simulieren/upload-safety/actions/workflows/ci.yml)
+[![license](https://img.shields.io/github/license/simulieren/upload-safety)](LICENSE)
+[![node](https://img.shields.io/badge/node-%E2%89%A522-339933)](package.json)
+[![dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](package.json)
+[![types](https://img.shields.io/badge/types-TypeScript-3178c6)](src/index.ts)
+
+Server-side upload checks for Node that read the file, not just its name. An upload passes only when its extension, its declared MIME type and its bytes agree, and when it carries nothing that runs on its own: no macros, embedded objects, DDE fields or PDF scripts. Photos lose their GPS position and other metadata on the way through.
+
+For apps that take CVs, invoices, contracts and photos from strangers and hand them to colleagues who open them in Office or Acrobat.
+
+```ts
+const result = checkUpload( { filename, mimeType, bytes }, { maxBytes: 10 * 1024 * 1024 } );
+if ( ! result.ok ) {
+	// result.reason: 'macros', 'encrypted', 'content-mismatch', ...
+}
+```
+
+## What it catches
+
+| Upload | Result |
+| - | - |
+| `cv.pdf` that is a Windows executable | refused, `content-mismatch` |
+| `report.docx` with a VBA project, also renamed or hidden behind a content type | refused, `macros` |
+| `invoice.docx` with an embedded OLE package that runs a file on double click | refused, `macros` |
+| `letter.docx` with a `DDEAUTO` field, also split across runs or spelled with `QUOTE` | refused, `macros` |
+| `template.docx` that loads a remote `.dotm` on opening | refused, `macros` |
+| `form.pdf` with JavaScript, a launch action or an attachment, also in compressed object streams | refused, `macros` |
+| `budget.xls` with a very hidden Excel 4.0 macro sheet | refused, `macros` |
+| `notes.odt` with a Basic macro or an event listener | refused, `macros` |
+| `contract.docx` saved with a password | refused, `encrypted` |
+| `data.xlsx` that is a zip bomb | refused, `content-mismatch` |
+| `holiday.jpg` with GPS coordinates | accepted, EXIF, XMP, IPTC and comments removed, orientation kept |
+| `../../CON.pdf`, a plain PDF | accepted, stored as `_CON.pdf` |
+
+Every check fails closed: a part it cannot read is a refusal, not a pass.
+
+## Why
+
+- **Zero runtime dependencies.** Only `node:zlib` and `node:crypto`. Nothing to audit but this package.
+- **Typed reasons.** Each refusal is one of seven string literals, so a `Record<UploadRejection, string>` of messages is checked by the compiler.
+- **Fast enough to run inline.** Synchronous; 647 real documents up to 20 MB each took at most 65 ms on a laptop.
+- **Tested against crafted files.** 213 tests build malformed ZIPs, compound files and PDFs byte by byte, next to real Office and PDF files.
+
+## Install
+
+```sh
+npm install upload-safety
+```
+
+Node 22 or later, ESM.
+
+## Usage
+
+### Web `Request` (Next.js route handlers, Hono, Remix, Bun)
+
+```ts
+import { checkUpload, type UploadRejection } from 'upload-safety';
+
+export async function POST( request: Request ) {
+	const file = ( await request.formData() ).get( 'file' );
+	if ( ! ( file instanceof File ) ) {
+		return Response.json( { error: 'No file.' }, { status: 400 } );
+	}
+
+	const result = checkUpload(
+		{ filename: file.name, mimeType: file.type, bytes: new Uint8Array( await file.arrayBuffer() ) },
+		{ maxBytes: 10 * 1024 * 1024, allowedExtensions: [ 'pdf', 'docx', 'jpg', 'jpeg', 'png' ] }
+	);
+	if ( ! result.ok ) {
+		return Response.json( { error: MESSAGES[ result.reason ] }, { status: 422 } );
+	}
+
+	// Store result.bytes under result.filename with result.mimeType.
+	return Response.json( { name: result.filename } );
+}
+
+const MESSAGES: Record<UploadRejection, string> = {
+	'empty': 'The file is empty.',
+	'too-large': 'The file is too large.',
+	'type-not-allowed': 'This file type is not allowed.',
+	'mime-mismatch': 'The file type does not match its extension.',
+	'content-mismatch': 'The file content does not match its extension.',
+	'macros': 'Files with macros or other active content are not allowed.',
+	'encrypted': 'Password-protected files cannot be checked.',
+};
+```
+
+### Express with multer
+
+```ts
+import express from 'express';
+import multer from 'multer';
+import { checkUpload } from 'upload-safety';
+
+const MAX_BYTES = 10 * 1024 * 1024;
+// Memory storage hands over the bytes; the limit stops a large body before it is buffered.
+const upload = multer( { storage: multer.memoryStorage(), limits: { fileSize: MAX_BYTES } } );
+const app = express();
+
+app.post( '/upload', upload.single( 'file' ), ( req, res ) => {
+	if ( ! req.file ) {
+		return res.status( 400 ).json( { error: 'No file.' } );
+	}
+	const result = checkUpload(
+		{ filename: req.file.originalname, mimeType: req.file.mimetype, bytes: req.file.buffer },
+		{ maxBytes: MAX_BYTES }
+	);
+	if ( ! result.ok ) {
+		return res.status( 422 ).json( { error: result.reason } );
+	}
+	// Store result.bytes under result.filename with result.mimeType.
+	res.json( { name: result.filename } );
+} );
+```
+
+### In the browser
+
+`acceptAttribute()` gives the matching value for the file picker. It only filters the dialog; the server check is what counts.
+
+```tsx
+<input type="file" accept={ acceptAttribute( [ 'pdf', 'docx' ] ) } />
+```
+
+## Formats
+
+| Format | Extensions | Checked beyond the magic number |
+| - | - | - |
+| PDF | `pdf` | JavaScript, launch, form submit and import actions, links to other files (`GoToR`, `GoToE`), multimedia, XFA forms and embedded files, also inside compressed object streams; encryption |
+| Office (OOXML) | `docx` `xlsx` `pptx` | Required parts; VBA and ActiveX parts; macro content types and relationships; embedded and linked OLE objects; altChunk imports; subdocuments, frames and remote templates; DDE fields in Word and DDE links in Excel; encryption |
+| Office (legacy) | `doc` `xls` `ppt` | OLE directory; VBA storages; embedded OLE objects; Excel 4.0 macro sheets; DDE and OLE links in Excel; PowerPoint VBA and object records; encryption flags |
+| OpenDocument | `odt` `ods` `odp` | The `mimetype` entry; Basic and script modules; embedded OLE objects; event listeners; links to macros; encrypted manifests |
+| Photos | `jpg` `jpeg` `png` | Structure; EXIF (GPS included), XMP, IPTC and comments are removed, the orientation is kept |
+
+ZIP and OLE reading is capped against zip bombs and malformed sector chains. A PDF that asks for a password is refused. One that only restricts permissions opens without a password and passes, unless its object streams are encrypted, since then they cannot be checked.
+
+## API
+
+`checkUpload` validates the descriptor, inspects the bytes, strips photo metadata and returns the sanitized file name and the canonical MIME type. The parts are exported on their own too:
+
+| Export | Does |
+| - | - |
+| `checkUpload( { filename, mimeType, bytes }, options )` | Every check below; `{ ok: true, extension, filename, mimeType, bytes }` or `{ ok: false, reason }` |
+| `validateUploadDescriptor( { filename, mimeType, size }, options )` | Size, extension and MIME checks before reading the body |
+| `inspectFileContent( extension, bytes )` | `'valid' \| 'macros' \| 'encrypted' \| 'mismatch'` |
+| `stripPhotoMetadata( extension, bytes )` | Cleaned bytes, the input for non-photos, `null` for a broken photo |
+| `sanitizeFilename( name )` | Drops path parts, unsafe characters and trailing dots, renames Windows device names such as `CON`, caps the length at 200 UTF-8 bytes |
+| `getCanonicalMimeType( extension )` | The MIME type to store |
+| `acceptAttribute( extensions? )` | Value for `<input type="file" accept>` |
+| `isEncryptedPdf( buffer )` | PDF encryption check alone |
+
+`options` takes `maxBytes` and, to narrow the built-in list, `allowedExtensions`. The reason `macros` covers all active content: VBA and Excel 4.0 macros, embedded OLE objects, DDE, event listeners and PDF scripts and attachments.
+
+## Limits
+
+These checks are not an antivirus scan. They refuse active content and anything they cannot read. They do not judge whether the data in an otherwise plain file is malicious, and they do not look inside a document embedded in another one, such as the workbook behind a Word chart. DDE is not looked for in legacy `.doc` files, nor in an `.xlsx` cell formula that names a DDE source without an external link part.
+
+The ZIP limits (`MAX_ZIP_UNCOMPRESSED_BYTES`, `MAX_ZIP_ENTRY_UNCOMPRESSED_BYTES`) are set to 100 MB. If a virus scanner runs after these checks, keep them at or below its own limits: ClamAV, for one, reports content past `MaxScanSize` and `MaxFileSize` as clean.
+
+## Before and after the checks
+
+The library checks the bytes it is handed. The rest of the upload path is up to you:
+
+- **Limit the request body before reading it.** `maxBytes` is checked after the whole file is in memory, so cap the body in your server or proxy first.
+- **Serve stored files as downloads.** Send `Content-Disposition: attachment` and `X-Content-Type-Options: nosniff`, and use the canonical `result.mimeType`, not the one the client declared. Serving uploads from a separate origin keeps a file that slips through away from your cookies.
+- **Limit image dimensions before resizing.** A small JPEG or PNG can declare a huge size. These checks do not decode images, so cap width and height in whatever makes thumbnails (sharp's `limitInputPixels`, ImageMagick's `policy.xml`).
+- **Expect metadata in documents.** Only JPEG and PNG uploads are stripped. Author names in Office and PDF files, and EXIF in images inside documents, are kept.
+- **Run a virus scanner if you need one.** These checks refuse active content; they do not recognise malware in data.
+
+## Development
+
+```sh
+npm install
+npm test
+npm run typecheck
+npm run build   # dist/ with .d.ts
+```
+
+Found a way past a check? Please report it privately, as [SECURITY.md](SECURITY.md) describes.
+
+## License
+
+[MIT](LICENSE)

package/dist/check-upload.d.ts

@@ -0,0 +1,23 @@
+import { type AllowedExtension, type DescriptorRejection, type UploadOptions } from './upload-allowlist.js';
+export type UploadRejection = DescriptorRejection | 'macros' | 'encrypted' | 'content-mismatch';
+export interface UploadInput {
+    filename: string;
+    /** The MIME type the client declared; empty when it sent none. */
+    mimeType: string;
+    bytes: Uint8Array;
+}
+export type UploadCheck = {
+    ok: true;
+    extension: AllowedExtension;
+    filename: string;
+    /** The canonical MIME type for the extension, not the declared one. */
+    mimeType: string;
+    /** The bytes to store; photos come without their metadata. */
+    bytes: Uint8Array;
+} | {
+    ok: false;
+    reason: UploadRejection;
+};
+/** Runs every check on an upload and returns what is safe to store. */
+export declare function checkUpload({ filename, mimeType, bytes }: UploadInput, options: UploadOptions): UploadCheck;
+//# sourceMappingURL=check-upload.d.ts.map

package/dist/check-upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-upload.d.ts","sourceRoot":"","sources":["../src/check-upload.ts"],"names":[],"mappings":"AACA,OAAO,EAIN,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,CAAC;AAEhG,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GACpB;IACD,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,KAAK,EAAE,UAAU,CAAC;CAClB,GACC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAE1C,uEAAuE;AACvE,wBAAgB,WAAW,CAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAI,WAAW,CAiB7G"}

package/dist/check-upload.js

@@ -0,0 +1,22 @@
+import { stripPhotoMetadata } from './photo-metadata.js';
+import { getCanonicalMimeType, inspectFileContent, validateUploadDescriptor, } from './upload-allowlist.js';
+/** Runs every check on an upload and returns what is safe to store. */
+export function checkUpload({ filename, mimeType, bytes }, options) {
+    const descriptor = validateUploadDescriptor({ filename, mimeType, size: bytes.byteLength }, options);
+    if (!descriptor.ok) {
+        return descriptor;
+    }
+    const { extension, sanitizedFilename } = descriptor;
+    const verdict = inspectFileContent(extension, bytes);
+    if (verdict === 'macros' || verdict === 'encrypted') {
+        return { ok: false, reason: verdict };
+    }
+    const stored = verdict === 'valid' ? stripPhotoMetadata(extension, bytes) : null;
+    if (!stored) {
+        return { ok: false, reason: 'content-mismatch' };
+    }
+    return {
+        ok: true, extension, filename: sanitizedFilename, mimeType: getCanonicalMimeType(extension), bytes: stored,
+    };
+}
+//# sourceMappingURL=check-upload.js.map

package/dist/check-upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-upload.js","sourceRoot":"","sources":["../src/check-upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACN,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GAIxB,MAAM,uBAAuB,CAAC;AAuB/B,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAe,EAAE,OAAsB;IAC9F,MAAM,UAAU,GAAG,wBAAwB,CAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,CAAE,CAAC;IACvG,IAAK,CAAE,UAAU,CAAC,EAAE,EAAG,CAAC;QACvB,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,UAAU,CAAC;IACpD,MAAM,OAAO,GAAG,kBAAkB,CAAE,SAAS,EAAE,KAAK,CAAE,CAAC;IACvD,IAAK,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,WAAW,EAAG,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAE,SAAS,EAAE,KAAK,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,IAAK,CAAE,MAAM,EAAG,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAClD,CAAC;IACD,OAAO;QACN,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,oBAAoB,CAAE,SAAS,CAAE,EAAE,KAAK,EAAE,MAAM;KAC5G,CAAC;AACH,CAAC"}

package/dist/excel-macro-sheets.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Finds Excel 4.0 macro sheets and VBA modules in the globals of a BIFF5/BIFF8
+ * Workbook stream, which list every sheet in a BoundSheet8 record [MS-XLS 2.4.28],
+ * DDE and OLE links, which a SupBook record introduces [MS-XLS 2.4.271], and
+ * encryption, which a FILEPASS record announces [MS-XLS 2.4.117].
+ */
+/**
+ * Whether the globals list a macro sheet or a DDE or OLE link, or encrypt the rest. The walk ends
+ * at their EOF, at FILEPASS or at a record that overruns the stream, which Excel could not read either.
+ */
+export declare function inspectExcelGlobals(workbook: Buffer): 'macros' | 'encrypted' | 'valid';
+//# sourceMappingURL=excel-macro-sheets.d.ts.map

package/dist/excel-macro-sheets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"excel-macro-sheets.d.ts","sourceRoot":"","sources":["../src/excel-macro-sheets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkBH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAE,QAAQ,EAAE,MAAM,GAAI,QAAQ,GAAG,WAAW,GAAG,OAAO,CAwBxF"}

package/dist/excel-macro-sheets.js

@@ -0,0 +1,51 @@
+/**
+ * Finds Excel 4.0 macro sheets and VBA modules in the globals of a BIFF5/BIFF8
+ * Workbook stream, which list every sheet in a BoundSheet8 record [MS-XLS 2.4.28],
+ * DDE and OLE links, which a SupBook record introduces [MS-XLS 2.4.271], and
+ * encryption, which a FILEPASS record announces [MS-XLS 2.4.117].
+ */
+const RECORD_HEADER_SIZE = 4;
+const BOUND_SHEET = 0x0085;
+const END_OF_FILE = 0x000a;
+// Everything after FILEPASS is encrypted, the sheet type included.
+const FILE_PASS = 0x002f;
+/** BoundSheet8 `dt` after lbPlyPos (4 bytes) and hsState (1 byte): 1 macro sheet, 6 VBA module. */
+const SHEET_TYPE_OFFSET = 5;
+const MACRO_SHEET_TYPES = [1, 6];
+// A SupBook names the source of external references. One of a DDE link (a formula such as
+// `=cmd|'/c calc'!A1`) or an OLE link lists no sheets, unlike an external workbook, and carries no
+// marker of the workbook itself or of add-in functions in place of the length of its path.
+const SUP_BOOK = 0x01ae;
+const SUP_BOOK_SIZE = 4;
+const SELF_REFERENCE = 0x0401;
+const ADD_IN_REFERENCE = 0x3a01;
+/**
+ * Whether the globals list a macro sheet or a DDE or OLE link, or encrypt the rest. The walk ends
+ * at their EOF, at FILEPASS or at a record that overruns the stream, which Excel could not read either.
+ */
+export function inspectExcelGlobals(workbook) {
+    let offset = 0;
+    while (offset + RECORD_HEADER_SIZE <= workbook.length) {
+        const type = workbook.readUInt16LE(offset);
+        const size = workbook.readUInt16LE(offset + 2);
+        const body = offset + RECORD_HEADER_SIZE;
+        if (type === FILE_PASS) {
+            return 'encrypted';
+        }
+        if (type === END_OF_FILE) {
+            return 'valid';
+        }
+        if (type === BOUND_SHEET && size > SHEET_TYPE_OFFSET && body + SHEET_TYPE_OFFSET < workbook.length &&
+            MACRO_SHEET_TYPES.includes(workbook[body + SHEET_TYPE_OFFSET])) {
+            return 'macros';
+        }
+        if (type === SUP_BOOK && size >= SUP_BOOK_SIZE && body + SUP_BOOK_SIZE <= workbook.length &&
+            workbook.readUInt16LE(body) === 0 &&
+            ![SELF_REFERENCE, ADD_IN_REFERENCE].includes(workbook.readUInt16LE(body + 2))) {
+            return 'macros';
+        }
+        offset = body + size;
+    }
+    return 'valid';
+}
+//# sourceMappingURL=excel-macro-sheets.js.map

package/dist/excel-macro-sheets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"excel-macro-sheets.js","sourceRoot":"","sources":["../src/excel-macro-sheets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,mEAAmE;AACnE,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,mGAAmG;AACnG,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,iBAAiB,GAAG,CAAE,CAAC,EAAE,CAAC,CAAE,CAAC;AACnC,0FAA0F;AAC1F,mGAAmG;AACnG,2FAA2F;AAC3F,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAE,QAAgB;IACpD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAQ,MAAM,GAAG,kBAAkB,IAAI,QAAQ,CAAC,MAAM,EAAG,CAAC;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAE,MAAM,CAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAE,MAAM,GAAG,CAAC,CAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,GAAG,kBAAkB,CAAC;QACzC,IAAK,IAAI,KAAK,SAAS,EAAG,CAAC;YAC1B,OAAO,WAAW,CAAC;QACpB,CAAC;QACD,IAAK,IAAI,KAAK,WAAW,EAAG,CAAC;YAC5B,OAAO,OAAO,CAAC;QAChB,CAAC;QACD,IAAK,IAAI,KAAK,WAAW,IAAI,IAAI,GAAG,iBAAiB,IAAI,IAAI,GAAG,iBAAiB,GAAG,QAAQ,CAAC,MAAM;YAClG,iBAAiB,CAAC,QAAQ,CAAE,QAAQ,CAAE,IAAI,GAAG,iBAAiB,CAAE,CAAE,EAAG,CAAC;YACtE,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,IAAK,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,aAAa,IAAI,IAAI,GAAG,aAAa,IAAI,QAAQ,CAAC,MAAM;YACzF,QAAQ,CAAC,YAAY,CAAE,IAAI,CAAE,KAAK,CAAC;YACnC,CAAE,CAAE,cAAc,EAAE,gBAAgB,CAAE,CAAC,QAAQ,CAAE,QAAQ,CAAC,YAAY,CAAE,IAAI,GAAG,CAAC,CAAE,CAAE,EAAG,CAAC;YACxF,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from './check-upload.js';
+export * from './upload-allowlist.js';
+export { stripPhotoMetadata } from './photo-metadata.js';
+export { isEncryptedPdf } from './pdf-encryption.js';
+export { MAX_ZIP_ENTRIES, MAX_ZIP_ENTRY_UNCOMPRESSED_BYTES, MAX_ZIP_UNCOMPRESSED_BYTES } from './zip-entries.js';
+export { MAX_OLE_STREAM_BYTES } from './ole-streams.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,gCAAgC,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACjH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export * from './check-upload.js';
+export * from './upload-allowlist.js';
+export { stripPhotoMetadata } from './photo-metadata.js';
+export { isEncryptedPdf } from './pdf-encryption.js';
+export { MAX_ZIP_ENTRIES, MAX_ZIP_ENTRY_UNCOMPRESSED_BYTES, MAX_ZIP_UNCOMPRESSED_BYTES } from './zip-entries.js';
+export { MAX_OLE_STREAM_BYTES } from './ole-streams.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,gCAAgC,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACjH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/ole-streams.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Reads the directory and streams of an OLE compound file (the container of
+ * legacy .doc/.xls/.ppt files) by following its sector chains.
+ * Returns null for anything malformed, oversized or outside versions 3 and 4.
+ */
+export interface OleDirectory {
+    /** Names of every storage and stream, at any depth. */
+    names: string[];
+    /** A stream right below the root, matched case-insensitively, or null when missing or malformed. */
+    readStream(name: string): Buffer | null;
+}
+/** Upper bounds that keep a crafted file from costing more than a real one. */
+export declare const MAX_OLE_STREAM_BYTES: number;
+export declare function readOleDirectory(content: Buffer): OleDirectory | null;
+//# sourceMappingURL=ole-streams.d.ts.map

package/dist/ole-streams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ole-streams.d.ts","sourceRoot":"","sources":["../src/ole-streams.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,YAAY;IAC5B,uDAAuD;IACvD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,oGAAoG;IACpG,UAAU,CAAE,IAAI,EAAE,MAAM,GAAI,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAwHrD,wBAAgB,gBAAgB,CAAE,OAAO,EAAE,MAAM,GAAI,YAAY,GAAG,IAAI,CA2FvE"}

package/dist/ole-streams.js

@@ -0,0 +1,192 @@
+/**
+ * Reads the directory and streams of an OLE compound file (the container of
+ * legacy .doc/.xls/.ppt files) by following its sector chains.
+ * Returns null for anything malformed, oversized or outside versions 3 and 4.
+ */
+/** Upper bounds that keep a crafted file from costing more than a real one. */
+export const MAX_OLE_STREAM_BYTES = 64 * 1024 * 1024;
+const MAX_OLE_SECTORS = 1 << 20;
+const SIGNATURE = Buffer.from([0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1]);
+const HEADER_SIZE = 512;
+const HEADER_FAT_SECTORS = 109;
+const BYTE_ORDER = 0xfffe;
+const MINI_SECTOR_SHIFT = 6;
+const MINI_SECTOR_SIZE = 1 << MINI_SECTOR_SHIFT;
+const MINI_STREAM_CUTOFF = 4096;
+const END_OF_CHAIN = 0xfffffffe;
+const FREE_SECTOR = 0xffffffff;
+const NO_ENTRY = 0xffffffff;
+const ENTRY_SIZE = 128;
+const STORAGE = 1;
+const STREAM = 2;
+const ROOT = 5;
+/**
+ * The first `count` sectors of a chain, or all up to its end without a count; null when one
+ * is out of range or repeats. Some writers run a chain on past its stream, as Office tolerates.
+ */
+function followChain(next, start, sectorCount, count) {
+    const visited = new Uint8Array(sectorCount);
+    const sectors = [];
+    let sector = start;
+    while (sector !== END_OF_CHAIN && sectors.length !== count) {
+        if (sector >= sectorCount || visited[sector]) {
+            return null;
+        }
+        visited[sector] = 1;
+        sectors.push(sector);
+        sector = next(sector);
+    }
+    return count === undefined || sectors.length === count ? sectors : null;
+}
+/** Reads a stream of `size` bytes, or a chain to its end without one, through an allocation table. */
+function chainReader(table, sector, sectorCount, sectorSize) {
+    const next = (index) => (index * 4 + 4 <= table.length ? table.readUInt32LE(index * 4) : FREE_SECTOR);
+    return (start, size) => {
+        if ((size ?? 0) > MAX_OLE_STREAM_BYTES) {
+            return null;
+        }
+        const count = size === undefined ? undefined : Math.ceil(size / sectorSize);
+        const sectors = count === 0 ? [] : followChain(next, start, sectorCount, count);
+        const data = sectors && Buffer.concat(sectors.map(sector));
+        return data && data.length >= (size ?? 0) ? data.subarray(0, size) : null;
+    };
+}
+/** The directory's entries, null for unused ones, or null when an entry is malformed. */
+function readEntries(directory, version) {
+    if (!directory) {
+        return null;
+    }
+    const entries = [];
+    for (let offset = 0; offset + ENTRY_SIZE <= directory.length; offset += ENTRY_SIZE) {
+        const nameLength = directory.readUInt16LE(offset + 0x40);
+        const type = directory[offset + 0x42];
+        // Version 3 writers may leave garbage in the upper half of the size.
+        const size = directory.readUInt32LE(offset + 0x78) + (version === 3 ? 0 : directory.readUInt32LE(offset + 0x7c) * 2 ** 32);
+        if (type !== STORAGE && type !== STREAM && type !== ROOT) {
+            entries.push(null);
+            continue;
+        }
+        if (nameLength < 2 || nameLength > 64 || nameLength % 2) {
+            return null;
+        }
+        entries.push({
+            name: directory.toString('utf16le', offset, offset + nameLength - 2),
+            type,
+            left: directory.readUInt32LE(offset + 0x44),
+            right: directory.readUInt32LE(offset + 0x48),
+            child: directory.readUInt32LE(offset + 0x4c),
+            start: directory.readUInt32LE(offset + 0x74),
+            size,
+        });
+    }
+    return entries[0]?.type === ROOT ? entries : null;
+}
+/**
+ * The entries right below the root, walked through the sibling tree, or null for a broken
+ * tree or two of the same name, of which a check could read another than Office.
+ */
+function readRootChildren(entries, root) {
+    const children = [];
+    const names = new Set();
+    const visited = new Set();
+    const pending = [root.child];
+    while (pending.length) {
+        const index = pending.pop();
+        if (index === NO_ENTRY) {
+            continue;
+        }
+        const entry = entries[index];
+        if (!entry || entry.type === ROOT || visited.has(index) || names.has(entry.name.toLowerCase())) {
+            return null;
+        }
+        visited.add(index);
+        names.add(entry.name.toLowerCase());
+        children.push(entry);
+        pending.push(entry.left, entry.right);
+    }
+    return children;
+}
+export function readOleDirectory(content) {
+    if (content.length < HEADER_SIZE || !content.subarray(0, SIGNATURE.length).equals(SIGNATURE) ||
+        content.readUInt16LE(0x1c) !== BYTE_ORDER || content.readUInt16LE(0x20) !== MINI_SECTOR_SHIFT ||
+        content.readUInt32LE(0x38) !== MINI_STREAM_CUTOFF) {
+        return null;
+    }
+    const version = content.readUInt16LE(0x1a);
+    const sectorShift = content.readUInt16LE(0x1e);
+    if (!(version === 3 && sectorShift === 9) && !(version === 4 && sectorShift === 12)) {
+        return null;
+    }
+    const sectorSize = 1 << sectorShift;
+    // Version 4 pads the header to a full sector; sector 0 follows it.
+    const sectorCount = Math.ceil((content.length - sectorSize) / sectorSize);
+    if (sectorCount <= 0 || sectorCount > MAX_OLE_SECTORS) {
+        return null;
+    }
+    const sector = (index) => content.subarray((index + 1) * sectorSize, (index + 2) * sectorSize);
+    // The FAT's sectors are listed in the header, then in the DIFAT chain.
+    const fatSectorCount = content.readUInt32LE(0x2c);
+    const difatSectorCount = content.readUInt32LE(0x48);
+    if (fatSectorCount > sectorCount || difatSectorCount > sectorCount) {
+        return null;
+    }
+    const fatSectors = [];
+    for (let index = 0; index < Math.min(fatSectorCount, HEADER_FAT_SECTORS); index++) {
+        fatSectors.push(content.readUInt32LE(0x4c + index * 4));
+    }
+    // Writers end the DIFAT chain with either marker, so its length comes from the header.
+    const difatSeen = new Set();
+    let difat = content.readUInt32LE(0x44);
+    for (let count = 0; count < difatSectorCount; count++) {
+        if (difat >= sectorCount || difatSeen.has(difat)) {
+            return null;
+        }
+        difatSeen.add(difat);
+        const entries = sector(difat);
+        for (let index = 0; index < sectorSize / 4 - 1 && fatSectors.length < fatSectorCount; index++) {
+            fatSectors.push(entries.readUInt32LE(index * 4));
+        }
+        difat = entries.readUInt32LE(sectorSize - 4);
+    }
+    if (fatSectors.length !== fatSectorCount || fatSectors.some((index) => index >= sectorCount)) {
+        return null;
+    }
+    const fat = Buffer.concat(fatSectors.map(sector));
+    const readChain = chainReader(fat, sector, sectorCount, sectorSize);
+    const directory = readEntries(readChain(content.readUInt32LE(0x30)), version);
+    const root = directory?.[0];
+    if (!directory || !root) {
+        return null;
+    }
+    const children = readRootChildren(directory, root);
+    if (!children) {
+        return null;
+    }
+    // Streams under the cutoff live in 64-byte sectors of the root's mini stream.
+    let readMiniChain;
+    const readSmallStream = (start, size) => {
+        if (!readMiniChain) {
+            const miniFatSectors = content.readUInt32LE(0x40);
+            const miniFat = miniFatSectors <= sectorCount ? readChain(content.readUInt32LE(0x3c), miniFatSectors * sectorSize) : null;
+            const miniStream = readChain(root.start, root.size);
+            readMiniChain = miniFat && miniStream ?
+                chainReader(miniFat, (index) => miniStream.subarray(index * MINI_SECTOR_SIZE, (index + 1) * MINI_SECTOR_SIZE), Math.ceil(miniStream.length / MINI_SECTOR_SIZE), MINI_SECTOR_SIZE) :
+                () => null;
+        }
+        return readMiniChain(start, size);
+    };
+    return {
+        names: directory.flatMap((entry) => (entry ? [entry.name] : [])),
+        readStream(name) {
+            const entry = children.find((child) => child.type === STREAM && child.name.toLowerCase() === name.toLowerCase());
+            if (!entry) {
+                return null;
+            }
+            if (entry.size === 0) {
+                return Buffer.alloc(0);
+            }
+            return entry.size < MINI_STREAM_CUTOFF ? readSmallStream(entry.start, entry.size) : readChain(entry.start, entry.size);
+        },
+    };
+}
+//# sourceMappingURL=ole-streams.js.map

package/dist/ole-streams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ole-streams.js","sourceRoot":"","sources":["../src/ole-streams.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACrD,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,CAAC;AAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAE,CAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAE,CAAE,CAAC;AACpF,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,gBAAgB,GAAG,CAAC,IAAI,iBAAiB,CAAC;AAChD,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,WAAW,GAAG,UAAU,CAAC;AAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC;AAC5B,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,IAAI,GAAG,CAAC,CAAC;AAYf;;;GAGG;AACH,SAAS,WAAW,CAAE,IAAkC,EAAE,KAAa,EAAE,WAAmB,EAAE,KAAc;IAC3G,MAAM,OAAO,GAAG,IAAI,UAAU,CAAE,WAAW,CAAE,CAAC;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAQ,MAAM,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAG,CAAC;QAC9D,IAAK,MAAM,IAAI,WAAW,IAAI,OAAO,CAAE,MAAM,CAAE,EAAG,CAAC;YAClD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,CAAE,MAAM,CAAE,GAAG,CAAC,CAAC;QACtB,OAAO,CAAC,IAAI,CAAE,MAAM,CAAE,CAAC;QACvB,MAAM,GAAG,IAAI,CAAE,MAAM,CAAE,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAID,sGAAsG;AACtG,SAAS,WAAW,CAAE,KAAa,EAAE,MAAmC,EAAE,WAAmB,EAAE,UAAkB;IAChH,MAAM,IAAI,GAAG,CAAE,KAAa,EAAG,EAAE,CAAC,CAAE,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAE,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,WAAW,CAAE,CAAC;IACpH,OAAO,CAAE,KAAK,EAAE,IAAI,EAAG,EAAE;QACxB,IAAK,CAAE,IAAI,IAAI,CAAC,CAAE,GAAG,oBAAoB,EAAG,CAAC;YAC5C,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAE,IAAI,GAAG,UAAU,CAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAE,CAAC;QAClF,MAAM,IAAI,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,CAAE,OAAO,CAAC,GAAG,CAAE,MAAM,CAAE,CAAE,CAAC;QAC/D,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,CAAE,IAAI,IAAI,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAE,CAAC,EAAE,IAAI,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,CAAC,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,SAAS,WAAW,CAAE,SAAwB,EAAE,OAAe;IAC9D,IAAK,CAAE,SAAS,EAAG,CAAC;QACnB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAM,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,IAAI,SAAS,CAAC,MAAM,EAAE,MAAM,IAAI,UAAU,EAAG,CAAC;QACtF,MAAM,UAAU,GAAG,SAAS,CAAC,YAAY,CAAE,MAAM,GAAG,IAAI,CAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,SAAS,CAAE,MAAM,GAAG,IAAI,CAAE,CAAC;QACxC,qEAAqE;QACrE,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAE,MAAM,GAAG,IAAI,CAAE,GAAG,CAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAE,MAAM,GAAG,IAAI,CAAE,GAAG,CAAC,IAAI,EAAE,CAAE,CAAC;QACjI,IAAK,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAG,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAE,IAAI,CAAE,CAAC;YACrB,SAAS;QACV,CAAC;QACD,IAAK,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,EAAE,IAAI,UAAU,GAAG,CAAC,EAAG,CAAC;YAC3D,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,CAAC,IAAI,CAAE;YACb,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,CAAC,CAAE;YACtE,IAAI;YACJ,IAAI,EAAE,SAAS,CAAC,YAAY,CAAE,MAAM,GAAG,IAAI,CAAE;YAC7C,KAAK,EAAE,SAAS,CAAC,YAAY,CAAE,MAAM,GAAG,IAAI,CAAE;YAC9C,KAAK,EAAE,SAAS,CAAC,YAAY,CAAE,MAAM,GAAG,IAAI,CAAE;YAC9C,KAAK,EAAE,SAAS,CAAC,YAAY,CAAE,MAAM,GAAG,IAAI,CAAE;YAC9C,IAAI;SACJ,CAAE,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAE,CAAC,CAAE,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAE,OAA4B,EAAE,IAAW;IACnE,MAAM,QAAQ,GAAY,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAG,CAAE,IAAI,CAAC,KAAK,CAAE,CAAC;IAC/B,OAAQ,OAAO,CAAC,MAAM,EAAG,CAAC;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC7B,IAAK,KAAK,KAAK,QAAQ,EAAG,CAAC;YAC1B,SAAS;QACV,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAE,KAAK,CAAE,CAAC;QAC/B,IAAK,CAAE,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAE,KAAK,CAAE,IAAI,KAAK,CAAC,GAAG,CAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAE,EAAG,CAAC;YACvG,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,CAAC,GAAG,CAAE,KAAK,CAAE,CAAC;QACrB,KAAK,CAAC,GAAG,CAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAE,KAAK,CAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAE,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAE,OAAe;IAChD,IAAK,OAAO,CAAC,MAAM,GAAG,WAAW,IAAI,CAAE,OAAO,CAAC,QAAQ,CAAE,CAAC,EAAE,SAAS,CAAC,MAAM,CAAE,CAAC,MAAM,CAAE,SAAS,CAAE;QACjG,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,KAAK,UAAU,IAAI,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,KAAK,iBAAiB;QACjG,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,KAAK,kBAAkB,EAAG,CAAC;QACvD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,CAAC;IACjD,IAAK,CAAE,CAAE,OAAO,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,CAAE,IAAI,CAAE,CAAE,OAAO,KAAK,CAAC,IAAI,WAAW,KAAK,EAAE,CAAE,EAAG,CAAC;QAC7F,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,IAAI,WAAW,CAAC;IACpC,mEAAmE;IACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAE,CAAE,OAAO,CAAC,MAAM,GAAG,UAAU,CAAE,GAAG,UAAU,CAAE,CAAC;IAC9E,IAAK,WAAW,IAAI,CAAC,IAAI,WAAW,GAAG,eAAe,EAAG,CAAC;QACzD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,CAAE,KAAa,EAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAE,CAAE,KAAK,GAAG,CAAC,CAAE,GAAG,UAAU,EAAE,CAAE,KAAK,GAAG,CAAC,CAAE,GAAG,UAAU,CAAE,CAAC;IAE/G,uEAAuE;IACvE,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,CAAC;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,CAAC;IACtD,IAAK,cAAc,GAAG,WAAW,IAAI,gBAAgB,GAAG,WAAW,EAAG,CAAC;QACtE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAM,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAE,cAAc,EAAE,kBAAkB,CAAE,EAAE,KAAK,EAAE,EAAG,CAAC;QACvF,UAAU,CAAC,IAAI,CAAE,OAAO,CAAC,YAAY,CAAE,IAAI,GAAG,KAAK,GAAG,CAAC,CAAE,CAAE,CAAC;IAC7D,CAAC;IACD,uFAAuF;IACvF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,KAAK,GAAG,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,CAAC;IACzC,KAAM,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,gBAAgB,EAAE,KAAK,EAAE,EAAG,CAAC;QACzD,IAAK,KAAK,IAAI,WAAW,IAAI,SAAS,CAAC,GAAG,CAAE,KAAK,CAAE,EAAG,CAAC;YACtD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,SAAS,CAAC,GAAG,CAAE,KAAK,CAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,CAAE,KAAK,CAAE,CAAC;QAChC,KAAM,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,cAAc,EAAE,KAAK,EAAE,EAAG,CAAC;YACjG,UAAU,CAAC,IAAI,CAAE,OAAO,CAAC,YAAY,CAAE,KAAK,GAAG,CAAC,CAAE,CAAE,CAAC;QACtD,CAAC;QACD,KAAK,GAAG,OAAO,CAAC,YAAY,CAAE,UAAU,GAAG,CAAC,CAAE,CAAC;IAChD,CAAC;IACD,IAAK,UAAU,CAAC,MAAM,KAAK,cAAc,IAAI,UAAU,CAAC,IAAI,CAAE,CAAE,KAAK,EAAG,EAAE,CAAC,KAAK,IAAI,WAAW,CAAE,EAAG,CAAC;QACpG,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAE,UAAU,CAAC,GAAG,CAAE,MAAM,CAAE,CAAE,CAAC;IACtD,MAAM,SAAS,GAAG,WAAW,CAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAE,CAAC;IAEtE,MAAM,SAAS,GAAG,WAAW,CAAE,SAAS,CAAE,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,CAAE,EAAE,OAAO,CAAE,CAAC;IACpF,MAAM,IAAI,GAAG,SAAS,EAAE,CAAE,CAAC,CAAE,CAAC;IAC9B,IAAK,CAAE,SAAS,IAAI,CAAE,IAAI,EAAG,CAAC;QAC7B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAE,SAAS,EAAE,IAAI,CAAE,CAAC;IACrD,IAAK,CAAE,QAAQ,EAAG,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,8EAA8E;IAC9E,IAAI,aAAsC,CAAC;IAC3C,MAAM,eAAe,GAAG,CAAE,KAAa,EAAE,IAAY,EAAkB,EAAE;QACxE,IAAK,CAAE,aAAa,EAAG,CAAC;YACvB,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,CAAC;YACpD,MAAM,OAAO,GAAG,cAAc,IAAI,WAAW,CAAC,CAAC,CAAC,SAAS,CAAE,OAAO,CAAC,YAAY,CAAE,IAAI,CAAE,EAAE,cAAc,GAAG,UAAU,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9H,MAAM,UAAU,GAAG,SAAS,CAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAE,CAAC;YACtD,aAAa,GAAG,OAAO,IAAI,UAAU,CAAC,CAAC;gBACtC,WAAW,CACV,OAAO,EACP,CAAE,KAAK,EAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAE,KAAK,GAAG,gBAAgB,EAAE,CAAE,KAAK,GAAG,CAAC,CAAE,GAAG,gBAAgB,CAAE,EAC9F,IAAI,CAAC,IAAI,CAAE,UAAU,CAAC,MAAM,GAAG,gBAAgB,CAAE,EACjD,gBAAgB,CAChB,CAAC,CAAC;gBACH,GAAG,EAAE,CAAC,IAAI,CAAC;QACb,CAAC;QACD,OAAO,aAAa,CAAE,KAAK,EAAE,IAAI,CAAE,CAAC;IACrC,CAAC,CAAC;IAEF,OAAO;QACN,KAAK,EAAE,SAAS,CAAC,OAAO,CAAE,CAAE,KAAK,EAAG,EAAE,CAAC,CAAE,KAAK,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,EAAE,CAAE,CAAE;QACxE,UAAU,CAAE,IAAI;YACf,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAE,CAAE,KAAK,EAAG,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAE,CAAC;YACrH,IAAK,CAAE,KAAK,EAAG,CAAC;gBACf,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAK,KAAK,CAAC,IAAI,KAAK,CAAC,EAAG,CAAC;gBACxB,OAAO,MAAM,CAAC,KAAK,CAAE,CAAC,CAAE,CAAC;YAC1B,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,GAAG,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,SAAS,CAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAE,CAAC;QAC5H,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/pdf-active-content.d.ts

@@ -0,0 +1,3 @@
+/** The verdict on a PDF: encrypted behind a password, holding active content, unreadable or plain. */
+export declare function inspectPdf(content: Buffer): 'valid' | 'macros' | 'encrypted' | 'mismatch';
+//# sourceMappingURL=pdf-active-content.d.ts.map

package/dist/pdf-active-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdf-active-content.d.ts","sourceRoot":"","sources":["../src/pdf-active-content.ts"],"names":[],"mappings":"AA2HA,sGAAsG;AACtG,wBAAgB,UAAU,CAAE,OAAO,EAAE,MAAM,GAAI,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,CAa3F"}